HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- dist/outbound/tls-fetch.js:19
- Evidence
rejectUnauthorized: false,
Security audit
OpenClaw A2A Plugin
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed A2A peer-messaging plugin, not a hidden skill bundle, but it uses Passport credentials and network-facing agent routes that need careful configuration.
Install this only if you intend to let OpenClaw send messages to remote A2A agents or accept inbound A2A requests. Protect the NEAR/Passport credential file, prefer RODiT or API-key auth over unauthenticated mode, avoid tlsSkipVerify except for controlled self-signed deployments, and review audit logging settings because message summaries can be written locally when enabled.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.insecure_tls_verification